How does one use oauth in a FLOSS app where we can't keep a secret key?

Question

How does one use oauth in a FLOSS app where we can't keep a secret key? If other see the secret and the key, can't he use it to use the user account as if he where me?

Answer 1

I have dealt with the issue in my own open source Twitter apps.

You do NOT distribute the ConsumerKey or ConsumerKeySecret with your source code. A reasonable approach is to create two constants/global variables (or whatever) that hold these values, and these are EMPTY in the source that you publish. Include some documentation that explains to other developers how to acquire their own keys and how to modify the source to install them.

If you are distributing compiled binaries, you would compile with the ConsumerKey and ConsumerKeySecret values populated so the application runs.

There is no -perfectly secure- way to handle this; it's the nature of OAuth. You can, however, be -reasonably- secure, and that's what this approach achieves.